The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
History

Thu, 07 Nov 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Automattic
Automattic jetpack
CPEs cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:*
Vendors & Products Automattic
Automattic jetpack
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 07 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
Description The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
Title Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
References

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-11-07T15:02:38.050Z

Updated: 2024-11-07T19:53:07.815Z

Reserved: 2024-10-14T09:27:37.145Z

Link: CVE-2024-9926

cve-icon Vulnrichment

Updated: 2024-11-07T18:40:39.188Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-07T15:15:05.860

Modified: 2024-11-08T19:01:03.880

Link: CVE-2024-9926

cve-icon Redhat

No data.